GNOME Bugzilla – Bug 730294
Use GnuTLS crypto API instead of gcrypt
Last modified: 2015-04-01 11:31:25 UTC
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=745955 The latest versions of gnutls no longer use gcrypt as crypto backend but nettle. Thus building network-manager against gnutls 3 means it will require two crypto libraries. This could be avoided by using the crypto API provided by GnuTLS. See the referenced bug report for more details.
Note, that when you build NM --with-crypto=gnutls, NM itself has a build- and runtime-dependency on libgcrypt. > network-manager uses both gnutls and gcrypt. However it does not > build-depend on libgcrypt11-dev or libgcrypt20-dev but instead relies > on libgnutls-dev depending on libgcrypt11-dev. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=745955#15 This would be a bug in the debian package, NM must itself depend on libgcrypt. But AFAIS, that is already fixed in Debian/testing(!?) Anyway, I agree, it seems like a nice optimization to use gnutls only. All the uses of libgcrypt are inside: libnm-util/crypto_gnutls.c
Right, the (currently) missing build-dependency on libgcrypt11-dev is a bug in the Debian package. It shouldn't rely on libgnutls-dev to pull in that dependency. But that is not what this (upstream) bug report is about.
Branch jk/gnutls-api-bgo730294 removes gcrypt dependency and uses gnutls crypto API instead.
(In reply to Jiri Klimes from comment #3) > Branch jk/gnutls-api-bgo730294 removes gcrypt dependency and uses gnutls > crypto API instead. crypto_gnutls.c:84:27: error: implicit conversion from enumeration type 'gnutls_mac_algorithm_t' to different enumeration type 'gnutls_digest_algorithm_t' [-Werror,-Wenum-conversion] if (gnutls_hash_get_len (GNUTLS_MAC_MD5) > MD5_HASH_LEN) { ~~~~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~ crypto_gnutls.c:88:37: error: implicit conversion from enumeration type 'gnutls_mac_algorithm_t' to different enumeration type 'gnutls_digest_algorithm_t' [-Werror,-Wenum-conversion] gnutls_hash_get_len (GNUTLS_MAC_MD5), MD5_HASH_LEN); ~~~~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~ crypto_gnutls.c:95:33: error: implicit conversion from enumeration type 'gnutls_mac_algorithm_t' to different enumeration type 'gnutls_digest_algorithm_t' [-Werror,-Wenum-conversion] err = gnutls_hash_init (&ctx, GNUTLS_MAC_MD5); ~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~
Right, GNUTLS_DIG_MD5 should be used instead of GNUTLS_MAC_MD5 (even though the values are the same.) Fixed and re-pushed the branch.
Looks good to me; testcases pass.
Pushed to master: b6f5f03 crypto: only use gnutls crypto API, remove libgcrypt dependency (bgo #730294)